CWE-20
Improper Input Validation
Description
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-10 · CAPEC-101 · CAPEC-104 · CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-120 · CAPEC-13 · CAPEC-135 · CAPEC-136 · CAPEC-14 · CAPEC-153 · CAPEC-182 · CAPEC-209 · CAPEC-22 · CAPEC-23 · CAPEC-230 · CAPEC-231 · CAPEC-24 · CAPEC-250 · CAPEC-261 · CAPEC-267 · CAPEC-28 · CAPEC-3 · CAPEC-31 · CAPEC-42 · CAPEC-43 · CAPEC-45 · CAPEC-46 · CAPEC-47 · CAPEC-473 · CAPEC-52 · CAPEC-53 · CAPEC-588 · CAPEC-63 · CAPEC-64 · CAPEC-664 · CAPEC-67 · CAPEC-7 · CAPEC-71 · CAPEC-72 · CAPEC-73 · CAPEC-78 · CAPEC-79 · CAPEC-8 · CAPEC-80 · CAPEC-81 · CAPEC-83 · CAPEC-85 · CAPEC-88 · CAPEC-9
CVEs mapped to this weakness (13,352)
page 108 of 668| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-25210 | Hig | 0.53 | 8.2 | 0.00 | Feb 10, 2026 | Improper input validation for some Server Firmware Update Utility(SysFwUpdt) before version 16.0.12 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation… | ||
| CVE-2026-20856 | Hig | 0.53 | 8.1 | 0.01 | Jan 13, 2026 | Improper input validation in Windows Server Update Service allows an unauthorized attacker to execute code over a network. | ||
| CVE-2025-66201 | Hig | 0.53 | 8.1 | 0.00 | Nov 29, 2025 | LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.1-rc2, LibreChat is vulnerable to Server-side Request Forgery (SSRF), by passing specially crafted OpenAPI specs to its "Actions" feature and making the LLM use those actions. It could be used by an… | ||
| CVE-2025-0248 | Hig | 0.53 | 8.1 | 0.00 | Nov 25, 2025 | HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A remote, unauthenticated attacker can specially craft a URL to execute script in a victim's Web browser within the security context of the… | ||
| CVE-2025-64759 | Hig | 0.53 | 8.1 | 0.00 | Nov 19, 2025 | Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution of arbitrary JavaScript in a user's browser, with minimal or no user interaction required, due to the rendering of a malicious uploaded SVG file. This could be… | ||
| CVE-2025-58353 | Hig | 0.53 | 8.2 | 0.00 | Sep 4, 2025 | Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All versions of Promptcraft Forge Studio sanitize user input using regex blacklists such as r`eplace(/javascript:/gi, '')`. Because the package uses multi-character… | ||
| CVE-2025-6585 | Hig | 0.53 | 8.1 | 0.00 | Jul 22, 2025 | The WP JobHunt plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.2 via the cs_remove_profile_callback() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers,… | ||
| CVE-2025-30391 | Hig | 0.53 | 8.1 | 0.01 | Apr 30, 2025 | Improper input validation in Microsoft Dynamics allows an unauthorized attacker to disclose information over a network. | ||
| CVE-2025-27493 | Hig | 0.53 | 8.2 | 0.00 | Mar 11, 2025 | A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-AP (All versions < V6.4.9). Affected devices improperly sanitize user input for specific commands on the telnet command line interface. This could allow an… | ||
| CVE-2025-27517 | Cri | 0.53 | — | 0.01 | Mar 5, 2025 | Volt is an elegantly crafted functional API for Livewire. Malicious, user-crafted request payloads could potentially lead to remote code execution within Volt components. This vulnerability is fixed in 1.7.0. | ||
| CVE-2023-43758 | Hig | 0.53 | 8.2 | 0.00 | Feb 12, 2025 | Improper input validation in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escalation of privilege via local access. | ||
| CVE-2024-21925 | Hig | 0.53 | 8.2 | 0.00 | Feb 11, 2025 | Improper input validation within the AmdPspP2CmboxV2 driver may allow a privileged attacker to overwrite SMRAM, leading to arbitrary code execution. | ||
| CVE-2024-0179 | Hig | 0.53 | 8.2 | 0.00 | Feb 11, 2025 | SMM Callout vulnerability within the AmdCpmDisplayFeatureSMM driver could allow locally authenticated attackers to overwrite SMRAM, potentially resulting in arbitrary code execution. | ||
| CVE-2024-49057 | Hig | 0.53 | 8.1 | 0.02 | Dec 12, 2024 | Microsoft Defender for Endpoint on Android Spoofing Vulnerability | ||
| CVE-2024-36482 | Hig | 0.53 | 8.2 | 0.00 | Nov 13, 2024 | Improper input validation in some Intel(R) CIP software before version 2.4.10852 may allow a privileged user to potentially enable escalation of privilege via local access. | ||
| CVE-2024-36282 | Hig | 0.53 | 8.2 | 0.00 | Nov 13, 2024 | Improper input validation in the Intel(R) Server Board S2600ST Family BIOS and Firmware Update software all versions may allow a privileged user to potentially enable escalation of privilege via local access. | ||
| CVE-2024-0126 | Hig | 0.53 | 8.2 | 0.00 | Oct 26, 2024 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability which could allow a privileged attacker to escalate permissions. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure,… | ||
| CVE-2024-49361 | Hig | 0.53 | — | 0.01 | Oct 18, 2024 | ACON is a widely-used library of tools for machine learning that focuses on adaptive correlation optimization. A potential vulnerability has been identified in the input validation process, which could lead to arbitrary code execution if exploited. This issue could allow an… | ||
| CVE-2024-38216 | Hig | 0.53 | 8.2 | 0.01 | Sep 10, 2024 | Azure Stack Hub Elevation of Privilege Vulnerability | ||
| CVE-2024-28947 | Hig | 0.53 | 8.2 | 0.00 | Aug 14, 2024 | Improper input validation in kernel mode driver for some Intel(R) Server Board S2600ST Family firmware before version 02.01.0017 may allow a privileged user to potentially enable escalation of privilege via local access. |
- risk 0.53cvss 8.2epss 0.00
Improper input validation for some Server Firmware Update Utility(SysFwUpdt) before version 16.0.12 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation…
- risk 0.53cvss 8.1epss 0.01
Improper input validation in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
- risk 0.53cvss 8.1epss 0.00
LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.1-rc2, LibreChat is vulnerable to Server-side Request Forgery (SSRF), by passing specially crafted OpenAPI specs to its "Actions" feature and making the LLM use those actions. It could be used by an…
- risk 0.53cvss 8.1epss 0.00
HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A remote, unauthenticated attacker can specially craft a URL to execute script in a victim's Web browser within the security context of the…
- risk 0.53cvss 8.1epss 0.00
Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution of arbitrary JavaScript in a user's browser, with minimal or no user interaction required, due to the rendering of a malicious uploaded SVG file. This could be…
- risk 0.53cvss 8.2epss 0.00
Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All versions of Promptcraft Forge Studio sanitize user input using regex blacklists such as r`eplace(/javascript:/gi, '')`. Because the package uses multi-character…
- risk 0.53cvss 8.1epss 0.00
The WP JobHunt plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.2 via the cs_remove_profile_callback() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers,…
- risk 0.53cvss 8.1epss 0.01
Improper input validation in Microsoft Dynamics allows an unauthorized attacker to disclose information over a network.
- risk 0.53cvss 8.2epss 0.00
A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-AP (All versions < V6.4.9). Affected devices improperly sanitize user input for specific commands on the telnet command line interface. This could allow an…
- risk 0.53cvss —epss 0.01
Volt is an elegantly crafted functional API for Livewire. Malicious, user-crafted request payloads could potentially lead to remote code execution within Volt components. This vulnerability is fixed in 1.7.0.
- risk 0.53cvss 8.2epss 0.00
Improper input validation in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escalation of privilege via local access.
- risk 0.53cvss 8.2epss 0.00
Improper input validation within the AmdPspP2CmboxV2 driver may allow a privileged attacker to overwrite SMRAM, leading to arbitrary code execution.
- risk 0.53cvss 8.2epss 0.00
SMM Callout vulnerability within the AmdCpmDisplayFeatureSMM driver could allow locally authenticated attackers to overwrite SMRAM, potentially resulting in arbitrary code execution.
- risk 0.53cvss 8.1epss 0.02
Microsoft Defender for Endpoint on Android Spoofing Vulnerability
- risk 0.53cvss 8.2epss 0.00
Improper input validation in some Intel(R) CIP software before version 2.4.10852 may allow a privileged user to potentially enable escalation of privilege via local access.
- risk 0.53cvss 8.2epss 0.00
Improper input validation in the Intel(R) Server Board S2600ST Family BIOS and Firmware Update software all versions may allow a privileged user to potentially enable escalation of privilege via local access.
- risk 0.53cvss 8.2epss 0.00
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability which could allow a privileged attacker to escalate permissions. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure,…
- risk 0.53cvss —epss 0.01
ACON is a widely-used library of tools for machine learning that focuses on adaptive correlation optimization. A potential vulnerability has been identified in the input validation process, which could lead to arbitrary code execution if exploited. This issue could allow an…
- risk 0.53cvss 8.2epss 0.01
Azure Stack Hub Elevation of Privilege Vulnerability
- risk 0.53cvss 8.2epss 0.00
Improper input validation in kernel mode driver for some Intel(R) Server Board S2600ST Family firmware before version 02.01.0017 may allow a privileged user to potentially enable escalation of privilege via local access.